# Sensitive-data input decision map

Synthetic employee information and proposed tasks. No actual lawful basis, consent or legal approval is established.

Invented workplace tasks separate purpose, data category and the additional Article 9 question, with a distinct Article 10 example.

| Proposed input | Category and issue | Decision in the exercise |
| --- | --- | --- |
| “Rewrite our generic sick-leave policy.” | A general policy can be discussed without anyone’s health record. | Use invented context; do not attach employee diagnoses. |
| “Explain this named employee’s diagnosis to their manager.” | Health data; purpose, necessity, recipients and Article 6/9 grounds require review. | Do not use the real record in this exercise; escalate the specific disclosure. |
| A named list of union subscriptions | Trade-union membership is special-category data. | Do not infer permission from payroll access; assess the particular purpose and legal condition. |
| Face images proposed for identity matching | Biometric processing for unique identification can bring Article 9 into scope. | Assess the actual processing and safeguards; a generic photo label is insufficient. |
| A report about a criminal conviction | Article 10 has separate conditions. | Route for the applicable criminal-offence-data review rather than assuming Article 9 alone resolves it. |

## Review steps

- Question the sensitive detail: Identify whether an invented example or general description achieves the purpose without the personal record.
- Record both legal layers: Document the Article 6 basis and applicable Article 9 condition, including relevant national-law requirements.
- Review the real destination: Assess role, instructions, transfers, retention, recipient access and the need for a DPIA.

## Safe comparison fixture

General version: “Suggest clear wording for a workplace policy explaining how employees can request an adjustment.”

Over-detailed synthetic version: “Taylor Example, our only night-shift supervisor, has the fictional condition Example Syndrome. Explain their adjustment request to the manager.”

Use invented material only. The second version illustrates contextual identifiability; it is not a real employee record or a finding that a particular legal condition applies.

## Source and scope

Guide: https://aona.ai/resources/guides/gdpr-special-category-data-ai-prompts/

Source check: 21 September 2026. General information; no professional approval or installed-product result is represented.

- EU GDPR: Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng